3 ms·

I had to stop using Keybase after this issue [1] cropped up: when you re-install your OS, you lose access to the "device" and have to provision a new one, even

by mholt 8y ago

I had to stop using Keybase after this issue [1] cropped up: when you re-install your OS, you lose access to the "device" and have to provision a new one, even though the machine is the same, and even in possession of an uncompromised private key. Apparently this happens a lot [2-7... probably more]. Unfortunately, this renders Keybase unusable for me because, even though I still have my private key, I cannot access my laptop's Keybase when I install it. [1]: https://github.com/keybase/client/issues/3460#issuecomment-278486140 https://github.com/keybase/client/issues/3460#issuecomment-2... [2]: https://github.com/keybase/client/issues/3559 https://github.com/keybase/client/issues/3559 [3]: https://github.com/keybase/keybase-issues/issues/1952 https://github.com/keybase/keybase-issues/issues/1952 [4]: https://github.com/keybase/keybase-issues/issues/1985 https://github.com/keybase/keybase-issues/issues/1985 [5]: https://github.com/keybase/client/issues/4260 https://github.com/keybase/client/issues/4260 [6]: https://github.com/keybase/client/issues/2357 https://github.com/keybase/client/issues/2357 [7]: https://github.com/keybase/client/issues/2675 https://github.com/keybase/client/issues/2675

nebulous1 8y ago
I'm not entirely sure what your issue is here. Why not reprovision (either with a different provisioned device or your paper key) and give it a new name?
- mholt 8y ago
  Because it's the same device as before. I only have one name for it.
  - nebulous1 8y ago
    Just call it device2?
    - mholt 8y ago
      That makes it impossible to recover my original device.
      - dcbadacd 8y ago
        and?
      - nebulous1 8y ago
        You don't need to reuse the original device name, just append a number to it. Think of it as device incarnation 2.
  - lyk 8y ago
    But it's not the same device, in removing your old operating system you've removed the device keys keybase uses for encryption.
eridius 8y ago
A comment in your [1] link points at https://github.com/keybase/keybase-issues/issues/1952#issuecomment-171432314 https://github.com/keybase/keybase-issues/issues/1952#issuec... which explains why device names are immutable. > The reason of this restriction is pretty important: we want people to be able to think of devices by name - say, when seeing them in a list, or when talking about them - and never have to think about key fingerprints or id's. The only way to achieve this safely is to make a device<->name map immutable and global, using the sig chain. Otherwise there are endless caveats and visual explanations needed showing the evolution of a device name over time. > Consider: if an intruder steals one or more of your keys and starts doing crap to your sig chain, they still can't change the definition of "iphone6s-white". It is set in stone, which is crucial to maintain the abstraction that "iphone6s-white" is a certain key. I agree that it sucks to have your device name become permanently unusable; I've hit this myself a few times, and it's mildly annoying to find that I have to pick a new device name in Keybase even though my local name for the device hasn't changed. But removing this restriction opens up a security vulnerability.

by mholt 8y ago

nebulous1 8y ago

I'm not entirely sure what your issue is here. Why not reprovision (either with a different provisioned device or your paper key) and give it a new name?

mholt 8y ago
Because it's the same device as before. I only have one name for it.
- nebulous1 8y ago
  Just call it device2?
  - mholt 8y ago
    That makes it impossible to recover my original device.
    - dcbadacd 8y ago
      and?
    - nebulous1 8y ago
      You don't need to reuse the original device name, just append a number to it. Think of it as device incarnation 2.
- lyk 8y ago
  But it's not the same device, in removing your old operating system you've removed the device keys keybase uses for encryption.

eridius 8y ago

A comment in your [1] link points at https://github.com/keybase/keybase-issues/issues/1952#issuecomment-171432314 https://github.com/keybase/keybase-issues/issues/1952#issuec... which explains why device names are immutable. > The reason of this restriction is pretty important: we want people to be able to think of devices by name - say, when seeing them in a list, or when talking about them - and never have to think about key fingerprints or id's. The only way to achieve this safely is to make a device<->name map immutable and global, using the sig chain. Otherwise there are endless caveats and visual explanations needed showing the evolution of a device name over time. > Consider: if an intruder steals one or more of your keys and starts doing crap to your sig chain, they still can't change the definition of "iphone6s-white". It is set in stone, which is crucial to maintain the abstraction that "iphone6s-white" is a certain key. I agree that it sucks to have your device name become permanently unusable; I've hit this myself a few times, and it's mildly annoying to find that I have to pick a new device name in Keybase even though my local name for the device hasn't changed. But removing this restriction opens up a security vulnerability.